What are the key differences between a GDPR data controller and a data processor?

A GDPR data controller determines how and why personal data is processed, while a data processor acts on behalf of the controller and processes data as instructed. Controllers are responsible for compliance with GDPR, while processors must follow the controller's instructions and ensure data security.